Network monitoring system

ABSTRACT

A monitoring apparatus includes a processor configured to capture a network transmission signal from a monitoring location in a monitoring target network; specify each of a plurality of sessions based on session specifying information contained in the captured network transmission signal; analyze, for specified each of the sessions, the network transmission signal and measure a quality index; transfer the quality index of each of the sessions, which is measured every predetermined period of time, as a quality measurement result to an aggregation apparatus until a predetermined threshold value of a processing capability is reached; and stop, when the predetermined threshold value of the processing capability is exceeded, measuring the quality index of one of the sessions in a high-load state, and in a next cycle, perform the measurement on one of the sessions in the high-load state.

CROSS-REFERENCE TO RELATED APPLICATION

This application is based upon and claims the benefit of priority of theprior Japanese Patent Application No. JP2013-041567, filed on Mar. 4,2013, the entire contents of which are incorporated herein by reference.

FIELD

The disclosures made herein relate to a network monitoring system.

BACKGROUND

In recent years, Internet Protocol (IP) integration in a communicationnetwork (hereinafter referred to simply as “network”) has been promotedand a plurality of communication services having different prioritiesare thus mixed in the same network, which causes a rapid increase intraffic.

It has become more important for a carrier (telecommunications carrier)having a network apparatus conforming to the IP to understand a serviceoperational status in the network and analyze a cause of an anomaly.

A network operated by such carrier includes a plurality of accessnetworks, which are deployed in respective regions with a core networkas its center, and the network has a huge number of access points. Inorder to analyze network transmission signals in detail, it is necessaryto arrange a monitoring apparatus at each position (each monitoringlocation) in the access network for the purpose of quality measurementand perform the quality measurement comprehensively based on thecaptured network transmission signals.

The following are related arts to the invention.

-   [Patent document 1] Japanese Patent Laid-Open Publication No. JP    2008-104027-   [Patent document 2] Japanese Patent Laid-Open Publication No. JP    2011-176586

SUMMARY

However, the cost for introducing the monitoring apparatus is increasedin proportion to the number of arranged monitoring apparatus, and hencea low-cost (inexpensive) monitoring apparatus is required. There is alsoa problem in that it becomes difficult to ensure that the qualitymeasurement is performed comprehensively when a further low-costmonitoring apparatus is pursued.

According to an aspect of the disclosures made herein, a monitoringapparatus includes a processor configured to capture a networktransmission signal from a monitoring location in a monitoring targetnetwork; specify each of a plurality of sessions based on sessionspecifying information contained in the captured network transmissionsignal; analyze, for specified each of the sessions, the networktransmission signal and measure a quality index; transfer the qualityindex of each of the sessions, which is measured every predeterminedperiod of time, as a quality measurement result to an aggregationapparatus until a predetermined threshold value of a processingcapability is reached; and stop, when the predetermined threshold valueof the processing capability is exceeded, measuring the quality index ofone of the sessions in a high-load state, and in a next cycle, performthe measurement on one of the sessions in the high-load state.

Objects and advantages of the disclosures will be realized and attainedby means of the elements and combinations particularly pointed out inthe claims.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustrating a configuration of a system ofone embodiment;

FIG. 2 is a diagram illustrating a monitoring target network in thesystem of the one embodiment;

FIG. 3 is a block diagram illustrating detailed configurations of acollection server and an aggregation server in the system of the oneembodiment;

FIG. 4A is a flowchart illustrating quality measurement processingperformed in the collection server;

FIG. 4B is a flowchart illustrating the quality measurement processingperformed in the collection server;

FIG. 5A is a table showing a state transition (initial state) of asession management table at the time of a steady load;

FIG. 5B is a table showing the state transition (measurement inprogress) of the session management table at the time of the steadyload;

FIG. 5C is a table showing the state transition (measurement finishedfor all sessions) of the session management table at the time of thesteady load;

FIG. 6A is a table showing the state transition (measurement inprogress) of the session management table before a high-load stateoccurs;

FIG. 6B is a table showing the state transition (measurement stopped) ofthe session management table when the high-load state occurs; and

FIG. 6C is a table showing the state transition (measurement resumed) ofthe session management table after the high-load state occurs.

DESCRIPTION OF EMBODIMENTS

The embodiment of the disclosures made herein will be described belowreferring to the drawings in detail. The drawings illustrate a preferredembodiment. It should be understood, however, that the embodiment can beimplemented by many different embodiments, and is not limited to theembodiment described herein.

[Network Monitoring System]

Referring to FIG. 1 illustrating a system configuration of oneembodiment, a network monitoring system 1 includes an aggregation server2, a plurality of collection servers 3, a core network 4, and aplurality of access networks 5.

The aggregation server 2 as a central aggregation apparatus aggregates(sums and performs statistical processing on) packet analysis results(quality measurement results) transferred periodically (every one minutein this case) from the plurality of collection servers 3 operating in atime-synchronized manner.

Each of the collection servers 3 as monitoring apparatus, which arearranged for the purpose of quality measurement in a distributed mannerso as to correspond to respective monitoring locations, captures, vianetwork transmission signal branching/extracting devices TAP (#1 to #8)inserted and connected between relay switches SW in the access networks5, transmission data (hereinafter sometimes referred to simply as“packet”) having a form of a packet for operation and passing through anetwork line as a network transmission signal, and then performs packetanalysis. For simplicity, FIG. 1 illustrates only the collection servers3 corresponding to the network transmission signal branching/extractingdevices TAP (#1 and #7) as an example.

The core network 4 includes a plurality of Internet Protocol (IP)routers such as edge routers ER as network apparatuses, and connects therespective edge routers ER to the access networks 5.

Each of the access networks 5 includes the plurality of relay switchesSW such as a layer 2 (L2) switch and a layer 3 (L3) switch as thenetwork apparatuses and the plurality of the network transmission signalbranching/extracting devices (hereinafter sometimes referred to simplyas “tap”) TAP.

In each of the access networks 5, the arrangement positions of the tapsTAP (#1 to #8), which are each inserted and connected between the relayswitches SW and branch and extract the network transmission signal(hereinafter sometimes referred to simply as “packet”) in a replicatedstate, correspond to quality measurement locations in respectivemonitoring target networks.

Each of the access networks 5 accommodates a base station controller(radio network controller (RNC)), a radio base station apparatus(evolved Node B (eNB)), or a gateway (GW) as a network apparatus 6forming various forms of networks such as a mobile wirelesscommunication network for Long Term Evolution (LTE) or a wireless localarea network (WLAN).

In the above-mentioned network monitoring system 1, the core network 4,the access networks 5, and the network apparatus 6 are facilitiesoperated by a telecommunications carrier (carrier).

(Monitoring Target Network)

FIG. 2 is a diagram illustrating the monitoring target network in thenetwork monitoring system 1 of the one embodiment illustrated in FIG. 1.

In one access network 5, the arrangement position of the tap TAP (forexample, #1) inserted and connected between the relay switches SWcorresponds to the quality measurement location in the monitoring targetnetwork.

One of the relay switches SW is connected via the network line to anetwork apparatus 6A having IP addresses corresponding to fourrespective ports A, B, C, and D, and is also connected via the networkline to a network apparatus 6B having IP addresses corresponding torespective four ports E, F, G, and H.

The other of the relay switches SW is connected via the network line tothe edge router ER as the network apparatus in the core network 4 havingIP addresses corresponding to two respective ports I and J.

As described in detail later, in the monitoring target network,respective connections each specified by a combination of one of IPaddresses A to D and E to H of the network apparatuses 6A and 6B and oneof IP addresses I and J of the edge router ER are managed as sessions bythe collection server 3.

(Collection Server)

Each of the collection servers 3 as the monitoring apparatus, which arearranged in a distributed manner at respective monitoring locations(respective quality measurement locations), includes the followingcomponents as a hardware configuration as illustrated in FIG. 3.Specifically, each of the collection servers 3 includes a centralprocessing unit (CPU) 31 as a processor, a random access memory (RAM) 32as a working memory, and a read only memory (ROM) (not shown) havingstored thereon a boot program for booting.

The collection server 3 further includes a disk 33 as a non-volatileflash memory for storing an operating system (OS), various types ofapplication programs, and various types of information (including data)in a rewritable manner and a network interface card (NIC) 34 as anetwork interface.

In order to logically implement a quality measurement processingfunction to be described in detail later, a control program (qualitymeasurement control program) is installed on the disk 33 as theapplication program in the collection server 3. In addition, in thecollection server 3, the CPU 31 constantly expands the control programin the RAM 32 and executes the control program as a resident program.

To describe in more detail, the collection server 3 includes a receptioncontrol section 321, a session management section 322, a flow ratemonitoring section 323, a packet analysis section 324, a sessionmanagement table 325, and a transmission control section 326 asfunctional components.

The reception control section 321 operating as a capture enginereceives, that is, captures the packet for operation passing through thenetwork line via the tap TAP, which is inserted and connected betweenthe relay switches SW in the access network 5 and branches and extractsthe packet for operation in a replicated state, and further via acapture port 341 of the NIC 34.

The session management section 322 uses the session management table 325to manage the session for each packet captured by the reception controlsection 321.

The flow rate monitoring section 323 monitors a throughput that isanalyzable depending on a packet analysis processing capability of thepacket analysis section 324, that is, a packet transfer amount (packetcount per unit time (packet per second (PPS))), and notifies the sessionmanagement section 322 of the monitored amount. When the transfer amountof packets exceeds a predetermined threshold value of the processingcapability, the session management section 322 stops the measurement ofthose packets.

The packet analysis section 324 identifies the session to be measuredbased on the notification sent from the session management section 322,and performs quality measurement periodically, that is, everypredetermined time interval (every one minute in this case).

The qualities to be measured for the monitoring target network include acommunication quality and a connection quality. Examples of an item tobe measured as the communication quality include the throughput (packettransfer amount) and a data amount ((packet count)×(packet length)).Examples of an item to be measured as the connection quality include aconnection request count for establishing the session, a connectioncompletion count, and a concurrent session count. Further, protocols tobe analyzed include the Transmission Control Protocol (TCP), the UserDatagram Protocol (UDP), and an upper-layer protocol. The packetanalysis section 324 analyzes a necessary item to be measured (qualityindex) based on quality data aggregated by the aggregation server 2.

The session management table 325 retains (stores), for each capturedpacket, a session start time, a transmission source IP address, adestination IP address, a throughput per second, and a measurement state(0: not measured, 1: measurement in progress, 2: measurement finished)in association with one another with use of session identificationinformation (ID) as key information (see, for example, FIG. 5A).

The session ID, the session start time, the transmission source IPaddress, the destination IP address, the throughput per second, and themeasurement state stored in the session management table 325 are set(automatically set) by the session management section 322 when thequality measurement processing is performed.

A combination of the transmission source IP address and the destinationIP address as session specifying information for specifying the sessionis extracted from the captured packet (to be exact, a header portion ofthe packet) by the session management section 322, and stored in thesession management table 325 in association with the session ID. Thesession management section 322 sets a time at which each session isregistered in the session management table 325 as the session start timefor the session. As described in detail later, for that purpose, thesession management section 322 learns the session existing in themonitoring target network for a predetermined period of time, and storesthe session in advance in the session management table 325.

The transmission control section 326 transmits the quality index foreach measurement result from a maintenance port 342 of the NIC 34 to theaggregation server 2 though the network line.

(Aggregation Server)

The aggregation server 2 as the central aggregation apparatus includesthe following components as a hardware configuration as illustrated inFIG. 3. Specifically, the aggregation server 2 includes a CPU 21 as aprocessor, a RAM 22 as a working memory, and a ROM (not shown) havingstored thereon a boot program for booting.

The aggregation server 2 further includes a disk 23 as a non-volatileflash memory for storing an OS, various types of application programs,and various types of information (including data) in a rewritable mannerand an NIC 24 as a network interface.

In order to logically implement an aggregation processing function foraggregating the quality measurement results, a control program(aggregation control program) is installed on the disk 23 as theapplication program in the aggregation server 2. In addition, in theaggregation server 2, the CPU 21 constantly expands the control programin the RAM 22 and executes the control program as a resident program.

To describe in more detail, the aggregation server 2 includes areception control section 221 and a quality data summing/statisticalprocessing section 222 as functional components.

In the aggregation server 2, the reception control section 221periodically (every one minute in this case) receives, via a maintenanceport 241 of the NIC 24, the quality indices from the respectivecollection servers 3 as the quality measurement results. Based on thequality measurement results received by the reception control section221, the quality data summing/statistical processing section 222 sumsand performs the statistical processing on the quality measurementresults.

A network operator can understand a network quality status of the entireaccess network 5 in real time by analyzing an aggregation result, whichis a result of the summing and statistical processing performed by theaggregation server 2. As application examples of data obtained byperforming the summing and statistical processing, visualization oftransition of the measured values and introduction of a mechanism forissuing an alarm in response to detection of outliers are conceivable.

[Quality Measurement Processing]

Next, a description is given of an example of the quality measurementprocessing in the network monitoring system 1 of the one embodiment withreference to FIGS. 1, 2, and 3 and related drawings.

FIGS. 4A and 4B illustrate a flow of the quality measurement processingperformed by the collection server 3.

FIGS. 5A, 5B, and 5C show state transitions of the session managementtable 325 at the time of a steady load. FIG. 5A shows the sessionmanagement table in an initial state, which is obtained after learningis performed for a predetermined period of time, and the measurementstates of a session ID “001” to a session ID “008” are each set to “0”meaning “not measured”. When the packet is received, the measurement isstarted based on a measurement cycle, and the measurement state of thereceived session is set to “1” meaning “measurement in progress” (seeFIG. 5B). Measurement target sessions are switched periodically, and themeasurement state of the session for which the measurement is finishedis set to “2” meaning “measurement finished”. When the measurementstates of all measurement target sessions are set to “2” meaning“measurement finished”, the measurement is completed (see FIG. 5C).

FIGS. 6A, 6B, and 6C show state transitions of the session managementtable 325 before a high-load state occurs, when the high-load stateoccurs, and after the high-load state occurs, respectively. When a totalthroughput per second exceeds the throughput threshold value during themeasurement (FIG. 6A), the measurement of the packet relating to thesession having the highest throughput per second is stopped, and themeasurement state of the session is updated to “0” meaning “notmeasured” (see FIG. 6B). The session whose measurement state has beenset to “not measured” is to be measured in the next cycle (see FIG. 6C).This processing is repeated until all sessions have “2” meaning“measurement finished” as their measurement states. With this, it ispossible to ensure that the measurement is performed comprehensively onthe measurement target sessions.

A description is given of this processing in detail. In the networkmonitoring system 1, the reception control section 321 of the collectionserver 3 receives (captures) via the NIC 34 the packet extracted by thetap TAP, which is inserted and connected between the relay switches SWcorresponding to the monitoring location of the monitoring targetnetwork and branches and extracts the packet (IP packet) for operationin a replicated state (S41 of FIG. 4A).

The session management section 322 acquires the transmission source IPaddress and the destination IP address as information necessary forspecifying the session based on the packet received by the receptioncontrol section 321. At this time, in addition to those addresses, thesession management section 322 acquires as necessary a media accesscontrol (MAC) address, a port number, a protocol number, and the likefrom the packet (S42 of FIG. 4A).

Based on the value of an already-learned flag (not shown) (alreadylearned: 1/not learned yet: 0) stored in the session management table325, the session management section 322 determines whether or not theexisting session has been learned for the predetermined period of time(one minute, for example) (S43 of FIG. 4A).

When the determination is negative in Step S43, the session managementsection 322 stores the acquired transmission source IP address anddestination IP address in the session management table 325 along withthe session ID and the session start time (S44 of FIG. 4A).

When Steps S41 to S44 are repeated for the predetermined period of time,the value of the already-learned flag is updated by the sessionmanagement section 322 to “1” meaning “already learned”. Moreover, thesession management table 325 having the state transition (at the time ofthe steady load, initial state) shown in FIG. 5A is generated as alearning result.

As shown in FIG. 5A, the sessions having the session ID “001” to thesession ID “008” are stored in the session management table 325 in theinitial state (time: 00:01:00). The session management section 322 setsthe session management table 325 so that the measurement states of therespective sessions having the session ID “001” to the session ID “008”each indicate “0” meaning “not measured” and the throughputs per secondof those sessions each indicate an initial value of “0”.

When the determination is positive in Step S43, the session managementsection 322 refers to the session management table 325 to determinewhether or not the measurement states of the measurement target sessionsare all “2” meaning “measurement finished” (S45 of FIG. 4B).

When the determination is positive in Step S45, the session managementsection 322 clears the measurement state (“2” meaning “measurementfinished”) in the session management table 325 (see FIG. 5C), in otherwords, sets the measurement state to “0” meaning the not-measured state(S46 of FIG. 4B).

When the determination is negative in Step S45, the session managementsection 322 distributes the packets for each session, and stores thepackets in its own packet accumulation buffers (first-in-first-out(FIFO) queues) (S47 of FIG. 4B).

The packet analysis section 324 identifies the measurement targetsession based on the notification sent from the session managementsection 322, and performs quality measurement on the packets stored inthe packet accumulation buffer every one minute (S48 of FIG. 4B).

Moreover, in the quality measurement, the packet analysis section 324measures the throughput per second for each session and notifies thesession management section 322 of the measured throughput per second.The session management section 322 stores the throughput per second foreach session that the session management section 322 is notified of inthe session management table 325 in association with the session ID (S49of FIG. 4B). With this, the session management table 325 having thestate transition (at the time of the steady load, measurement inprogress) shown in FIG. 5B is generated.

As shown in FIG. 5B, the sessions having the session ID “001” to thesession ID “008” are stored in the session management table 325 having“measurement in progress” as the state transition (time: 00:01:30). Thesession management section 322 sets the session management table 325 sothat the measurement states of the respective sessions having thesession IDs “001”, “002”, and “003” each indicate “1” meaning“measurement in progress” and the throughputs per second of thosesessions indicate “20”, “40”, and “40”, respectively.

The session management section 322 determines whether or not thepredetermined period of time (one minute in this case) has been reachedas a measurement finishing condition (S50 of FIG. 4B).

The flow rate monitoring section 323 acquires the throughput per secondfor each session from the session management section 322, and constantlymonitors whether or not the total throughput per second exceeds thepredetermined threshold value of the processing capability (throughputthreshold value of 100 in this case). After the determination isnegative in Step S50, the processing flow returns to Step S41 at thetime of the steady load, which is a period of time until the totalthroughput per second reaches the throughput threshold value, and themeasurement is continuously performed (S51 of FIG. 4B).

When the determination is positive in Step S50, the packet analysissection 324 notifies the transmission control section 326 of the qualitymeasurement result of the packets for which the measurement is finished.The transmission control section 326 transmits, via the maintenance port342 of the NIC 34, the quality measurement result measured by the packetanalysis section 324 to the aggregation server 2 (S52 of FIG. 4B).

After Step S52, the session management section 322 updates the sessionmanagement table 325, and the processing flow returns to Step S41 (S54of FIG. 4B).

When the measurement is finished for all sessions, the sessionmanagement table 325 having the state transition (at the time of thesteady load, measurement finished for all sessions) shown in FIG. 5C isgenerated.

As shown in FIG. 5C, the session management section 322 updates thesession management table 325 having “measurement finished for allsessions” (time: 00:04:00) as the state transition so that themeasurement states of the respective sessions having the session ID“001” to the session ID “008” each indicate “2” meaning “measurementfinished” and the throughputs per second of those sessions each indicatethe initial value of “0”.

It can be understood from FIG. 5C that the measurement for all sessionshaving the session ID “001” to the session ID “008” is completed inthree minutes corresponding to three cycles.

Further, after the determination is negative in Step S50, whendetermining that the total throughput per second (120 in this case)exceeds the throughput threshold value (100 in this case) (that is, whenthe high-load state occurs), the flow rate monitoring section 323notifies the session management section 322 of the session having thehighest throughput per second. The session management section 322instructs the packet analysis section 324 to stop the qualitymeasurement of the packets for the session that the flow rate monitoringsection 323 has notified the session management section 322 of (S53 ofFIG. 4B).

After Step S53, the session management section 322 updates the sessionmanagement table 325, and the processing flow returns to Step S41 (S54of FIG. 4B). The session management section 322 in this case updates thesession management table 325 by setting the measurement state of thesession for which the measurement is finished, specifically, the sessionhaving the throughput per second “60” and corresponding to the sessionID “002”, from “1” meaning “measurement in progress” to “0” meaning “notmeasured” (see FIG. 6B).

The session whose measurement state has been set to “not measured” is tobe measured in the next cycle (see FIG. 6C). This processing is repeateduntil all sessions have “measurement finished” as their measurementstates.

The collection server 3 described above captures the packets from themonitoring location in the monitoring target network, specifies each ofthe plurality of sessions based on the session specifying informationcontained in the captured packet, analyzes the packets for eachspecified session, and measures the quality index. Then, until thepredetermined threshold value of the processing capability is reached,the collection server 3 transfers to the aggregation server 2 thequality index for each session, which is measured every predeterminedperiod of time, as the quality measurement results. Moreover, when thepredetermined threshold value of the processing capability is exceeded,the collection server 3 stops the measurement of the quality index forthe session in the high-load state, and performs the measurement for thestopped session in the next cycle.

With this, the load imposed on the collection server 3 is reduced and astate in which a processing capacity is exceeded owing to the high-loadstate is prevented, and it is thus possible to realize the collectionserver 3 that is inexpensive and has a small resource (lowspecification). A quality deterioration in the monitoring target networkoccurs continuously, and hence the quality deterioration can be detectedthrough an analysis that ensures that the quality measurement isperformed comprehensively.

Effects of Embodiment

According to the disclosed monitoring apparatus, it is possible toachieve a further low-cost monitoring apparatus and ensure that qualitymeasurement is performed comprehensively.

Modified Example

In the one embodiment described above, the throughput is used as thepredetermined threshold value of the processing capability, but anotherquality index such as the data amount may be used. Further, the totalthroughput per second of the sessions for which the measurement is inprogress is used as the condition for determining whether or not thethreshold value is exceeded, but in place of this, a processing overflowat the packet accumulation buffer or a CPU usage ratio may be used. Inany of those determination methods, one value can be fixedly determinedin advance as the threshold value to be used for the determination, butthe threshold value may be dynamically changed depending on an operationcondition or the like.

The processing of the embodiment described above is provided as acomputer-executable program, and can be provided by a non-transitoryreadable recording medium such as a CD-ROM or a flexible disk or via acommunication line.

An arbitrary plurality of or all the processes of the embodimentdescribed above can be selected and combined to be carried out.

What is claimed is:
 1. A monitoring apparatus, comprising a processorconfigured to: capture a network transmission signal from a monitoringlocation in a monitoring target network; specify each of a plurality ofsessions based on session specifying information contained in thecaptured network transmission signal; analyze, for specified each of thesessions, the network transmission signal and measure a quality index;transfer the quality index of each of the sessions, which is measuredevery predetermined period of time, as a quality measurement result toan aggregation apparatus until a predetermined threshold value of aprocessing capability is reached; and stop, when the predeterminedthreshold value of the processing capability is exceeded, measuring thequality index of one of the sessions in a high-load state, and in a nextcycle, perform the measurement on one of the sessions in the high-loadstate.
 2. The monitoring apparatus according to claim 1, wherein: theprocessor includes a session management table for storing, for each ofcaptured network transmission signals, a transmission source address, adestination address, a throughput, and a measurement state inassociation with one another with use of session identificationinformation as key information; and the measurement state includes anot-measured state, a measurement-in-progress state, and ameasurement-finished state.
 3. The monitoring apparatus according toclaim 2, wherein: the processor learns the sessions existing in themonitoring target network, acquires transmission source addresses anddestination addresses as the session specifying information contained inthe captured network transmission signals, and stores the acquiredtransmission source addresses and the acquired destination addresses inadvance in the session management table along with the sessionidentification information; and the throughput is set to an initialvalue and the measurement state is set to the not-measured state.
 4. Themonitoring apparatus according to claim 2, wherein the processorsequentially sets one of the plurality of sessions having thenot-measured state as the measurement state in the session managementtable as a measurement target session for the quality index, and repeatsthe measurement of the quality index until measurement states of allmeasurement target sessions make a transition from themeasurement-in-progress state to the measurement-finished state.
 5. Themonitoring apparatus according to claim 1, wherein the networktransmission signal is a packet for operation extracted by a tap, whichis inserted and connected between network apparatuses corresponding to amonitoring location in the monitoring target network and branches andextracts the network transmission signal in a replicated state.
 6. Themonitoring apparatus according to claim 1, wherein: the quality indexincludes a throughput of the network transmission signal; and when thenetwork transmission signal is a packet, the throughput is defined by apacket transfer amount.
 7. The monitoring apparatus according to claim1, wherein: the predetermined threshold value of the processingcapability is a threshold value corresponding to an analyzablethroughput of the network transmission signal; and when the networktransmission signal is a packet, the throughput is defined by a packettransfer amount.
 8. A monitoring method by which a processor in amonitoring apparatus executes processing comprising: capturing a networktransmission signal from a monitoring location in a monitoring targetnetwork; specifying each of a plurality of sessions based on sessionspecifying information contained in the captured network transmissionsignal; analyzing, for specified each of the sessions, the networktransmission signal and measure a quality index; transferring thequality index of each of the sessions, which is measured everypredetermined period of time, as a quality measurement result to anaggregation apparatus until a predetermined threshold value of aprocessing capability is reached; and stopping, when the predeterminedthreshold value of the processing capability is exceeded, measuring thequality index of one of the sessions in a high-load state, and in a nextcycle, perform the measurement on one of the sessions in the high-loadstate.
 9. A non-transitory readable medium, which is recorded with aprogram that causes a processor in a monitoring apparatus to executeprocessing comprising: capturing a network transmission signal from amonitoring location in a monitoring target network; specifying each of aplurality of sessions based on session specifying information containedin the captured network transmission signal; analyzing, for specifiedeach of the sessions, the network transmission signal and measure aquality index; transferring the quality index of each of the sessions,which is measured every predetermined period of time, as a qualitymeasurement result to an aggregation apparatus until a predeterminedthreshold value of a processing capability is reached; and stopping,when the predetermined threshold value of the processing capability isexceeded, measuring the quality index of one of the sessions in ahigh-load state, and in a next cycle, perform the measurement on one ofthe sessions in the high-load state.